2f866a7825d7c86401404b61ec9b6809cc8b18e1f79f1eafefe65bde4bab3373 | Triage

Analysis

max time kernel
16s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2f866a7825d7c86401404b61ec9b6809cc8b18e1f79f1eafefe65bde4bab3373.exe
Size

148KB
MD5

815ef59857cebcc18d2fda76c1eea62e
SHA1

7092339e2e5115d1666028f8d4b5aaae1e25c758
SHA256

2f866a7825d7c86401404b61ec9b6809cc8b18e1f79f1eafefe65bde4bab3373
SHA512

2cf9570006aef9da8f942f52c84ad43182daa3ec89cb73f4f20006499d17586c64df673cbd8a1ab1fbc329cbb77a12f2e433b99d06a2e539d8f3e1463d25b52d
SSDEEP

3072:XKDAfCDSmJSG7fhytc4GRGqPXrNg2L4QozpWqFGes:XR0NUc4Yrr3HagTT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2f866a7825d7c86401404b61ec9b6809cc8b18e1f79f1eafefe65bde4bab3373.exe
"C:\Users\Admin\AppData\Local\Temp\2f866a7825d7c86401404b61ec9b6809cc8b18e1f79f1eafefe65bde4bab3373.exe"
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download